program: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x1}) r2 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'syzkaller1\x00', 0x0}) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', 0x1}) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=@newtfilter={0xf8, 0x2c, 0x607, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0xb, 0x7}, {0xa, 0xffff}, {0x300}}, [@filter_kind_options=@f_matchall={{0xd}, {0xc4, 0x2, [@TCA_MATCHALL_ACT={0xc0, 0x2, [@m_mirred={0xbc, 0x1, 0x0, 0x0, {{0xb}, {0x84, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x8000, 0x9, 0x10000005, 0x3, 0xd}, 0x4}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x7, 0x459, 0x5, 0x1, 0x2}, 0x3, r3}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x8, 0x9, 0x10000000, 0x4, 0x559}, 0x4, r3}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x8, 0x4e, 0x10000000, 0xfffffff0, 0x155}, 0x1, r3}}]}, {0x10, 0x6, "a612b257a235533a9ca14f5a"}, {0xc}, {0xc, 0x8, {0x1, 0x1}}}}]}]}}]}, 0xf8}}, 0x0) write(r1, &(0x7f00000004c0)='\x00\x00\b\x00', 0x4) [ 86.451106][ T4645] Bluetooth: hci0: command tx timeout [ 86.682221][ T5330] ------------[ cut here ]------------ [ 86.682236][ T5330] skb_assert_len [ 86.682254][ T5330] WARNING: ./include/linux/skbuff.h:2736 at __dev_queue_xmit+0x1fd7/0x3920, CPU#0: syz.0.0/5330 [ 86.690575][ T5330] Modules linked in: [ 86.692063][ T5330] CPU: 0 UID: 0 PID: 5330 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 86.695206][ T5330] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 86.699356][ T5330] RIP: 0010:__dev_queue_xmit+0x1fde/0x3920 [ 86.702037][ T5330] Code: 48 c7 44 24 08 00 00 00 00 e9 58 fe ff ff e8 f9 a4 11 f8 90 0f 0b 90 e9 ba e1 ff ff 48 8d 3d 19 56 d3 07 48 c7 c6 64 58 68 8e <67> 48 0f b9 3a 80 3d 9f 9a ad 07 01 0f 85 78 03 00 00 e8 cb a4 11 [ 86.712790][ T5330] RSP: 0018:ffffc9000ea06b40 EFLAGS: 00010246 [ 86.715415][ T5330] RAX: ffffffff89b67364 RBX: ffff88801fa97210 RCX: ffff88800030cb00 [ 86.718766][ T5330] RDX: 0000000000000002 RSI: ffffffff8e685864 RDI: ffffffff9189e770 [ 86.722231][ T5330] RBP: ffffc9000ea06df0 R08: ffff888053fa1ee3 R09: 1ffff1100a7f43dc [ 86.725545][ T5330] R10: dffffc0000000000 R11: ffffffff89dee2c0 R12: dffffc0000000000 [ 86.728981][ T5330] R13: 1ffff92001d40d88 R14: 0000000000000000 R15: ffff88801fa97210 [ 86.732278][ T5330] FS: 00007f3be72016c0(0000) GS:ffff88808b0b0000(0000) knlGS:0000000000000000 [ 86.735687][ T5330] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 86.738307][ T5330] CR2: 0000200000000000 CR3: 000000001fabb000 CR4: 0000000000352ef0 [ 86.741590][ T5330] Call Trace: [ 86.743126][ T5330] [ 86.744444][ T5330] ? lock_acquire+0x115/0x350 [ 86.746472][ T5330] ? is_bpf_text_address+0x292/0x2b0 [ 86.748719][ T5330] ? is_bpf_text_address+0x26/0x2b0 [ 86.750872][ T5330] ? kmem_cache_alloc_noprof+0x156/0x600 [ 86.753458][ T5330] ? __pfx___dev_queue_xmit+0x10/0x10 [ 86.755715][ T5330] ? do_raw_spin_lock+0x12b/0x2f0 [ 86.757853][ T5330] ? lock_acquire+0x115/0x350 [ 86.759879][ T5330] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 86.762483][ T5330] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 86.764860][ T5330] ? stack_depot_save_flags+0x3e0/0x7f0 [ 86.767179][ T5330] ? skb_clone+0x212/0x3a0 [ 86.769080][ T5330] ? kmem_cache_alloc_noprof+0x156/0x600 [ 86.771473][ T5330] ? __pfx_dev_queue_xmit+0x10/0x10 [ 86.773773][ T5330] sch_frag_xmit_hook+0x28b/0x1550 [ 86.775889][ T5330] ? tcf_mirred_to_dev+0x274/0xe60 [ 86.778043][ T5330] ? tcf_mirred_act+0x1169/0x1880 [ 86.779957][ T5330] ? tcf_classify+0x43d/0x1160 [ 86.782031][ T5330] ? tc_run+0x42d/0x750 [ 86.783851][ T5330] ? __netif_receive_skb_core+0x1443/0x30c0 [ 86.786278][ T5330] ? netif_receive_skb+0x1fe/0xbf0 [ 86.788400][ T5330] ? tun_rx_batched+0x1de/0x790 [ 86.790532][ T5330] ? __pfx_sch_frag_xmit_hook+0x10/0x10 [ 86.793045][ T5330] ? ksys_write+0x150/0x270 [ 86.794960][ T5330] ? do_syscall_64+0x166/0x520 [ 86.796895][ T5330] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.799442][ T5330] ? __copy_skb_header+0xa3/0x4a0 [ 86.801634][ T5330] ? __asan_memcpy+0x40/0x70 [ 86.803710][ T5330] ? __skb_clone+0x5c/0x6c0 [ 86.805634][ T5330] ? __skb_clone+0x449/0x6c0 [ 86.807648][ T5330] ? skb_clone+0x246/0x3a0 [ 86.809567][ T5330] ? tcf_mirred_to_dev+0x2c5/0xe60 [ 86.811906][ T5330] tcf_mirred_to_dev+0x854/0xe60 [ 86.814032][ T5330] tcf_mirred_act+0x1169/0x1880 [ 86.816189][ T5330] ? __pfx_tcf_mirred_act+0x10/0x10 [ 86.818421][ T5330] ? skb_copy_bits+0x83/0x8e0 [ 86.820425][ T5330] tcf_action_exec+0x185/0x8d0 [ 86.822496][ T5330] tcf_classify+0x43d/0x1160 [ 86.824429][ T5330] tc_run+0x42d/0x750 [ 86.826112][ T5330] ? __pfx_tc_run+0x10/0x10 [ 86.828072][ T5330] __netif_receive_skb_core+0x1443/0x30c0 [ 86.830483][ T5330] ? __pfx___netif_receive_skb_core+0x10/0x10 [ 86.833072][ T5330] ? __alloc_skb+0x27a/0x7a0 [ 86.835153][ T5330] ? rcu_is_watching+0x16/0xb0 [ 86.837071][ T5330] ? __alloc_skb+0x27a/0x7a0 [ 86.838912][ T5330] ? trace_kmem_cache_alloc+0x29/0xe0 [ 86.841165][ T5330] ? netif_receive_skb+0x102/0xbf0 [ 86.843465][ T5330] ? netif_receive_skb+0x102/0xbf0 [ 86.845731][ T5330] netif_receive_skb+0x1fe/0xbf0 [ 86.847957][ T5330] ? __pfx_netif_receive_skb+0x10/0x10 [ 86.850229][ T5330] ? tun_rx_batched+0x185/0x790 [ 86.852359][ T5330] tun_rx_batched+0x1de/0x790 [ 86.854362][ T5330] ? __pfx_tun_rx_batched+0x10/0x10 [ 86.856661][ T5330] ? lock_acquire+0x115/0x350 [ 86.858672][ T5330] ? tun_get_user+0x1d3f/0x4450 [ 86.860583][ T5330] ? __local_bh_enable_ip+0xd6/0x140 [ 86.862877][ T5330] tun_get_user+0x2bb1/0x4450 [ 86.864828][ T5330] ? tun_get_user+0x27a6/0x4450 [ 86.866724][ T5330] ? aa_file_perm+0x18b/0x15f0 [ 86.868744][ T5330] ? aa_file_perm+0x4ed/0x15f0 [ 86.870772][ T5330] ? __pfx_tun_get_user+0x10/0x10 [ 86.873098][ T5330] ? __lock_acquire+0x747/0x2de0 [ 86.875208][ T5330] ? ref_tracker_alloc+0x341/0x4b0 [ 86.877188][ T5330] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 86.879337][ T5330] ? lock_acquire+0x115/0x350 [ 86.881224][ T5330] ? tun_get+0x1c/0x2f0 [ 86.882988][ T5330] ? tun_get+0x1c/0x2f0 [ 86.884609][ T5330] ? tun_get+0x1c/0x2f0 [ 86.886201][ T5330] tun_chr_write_iter+0x113/0x200 [ 86.888269][ T5330] vfs_write+0x612/0xba0 [ 86.890027][ T5330] ? __pfx_vfs_write+0x10/0x10 [ 86.892241][ T5330] ? __fget_files+0x3a2/0x420 [ 86.894343][ T5330] ? __fget_files+0x2a/0x420 [ 86.896450][ T5330] ? fdget+0x1ac/0x250 [ 86.898274][ T5330] ksys_write+0x150/0x270 [ 86.900118][ T5330] ? __pfx_ksys_write+0x10/0x10 [ 86.902388][ T5330] do_syscall_64+0x166/0x520 [ 86.904388][ T5330] ? trace_irq_disable+0x3b/0x140 [ 86.906615][ T5330] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.909423][ T5330] ? clear_bhb_loop+0x70/0xc0 [ 86.911533][ T5330] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.914077][ T5330] RIP: 0033:0x7f3be639f559 [ 86.915914][ T5330] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 86.924115][ T5330] RSP: 002b:00007f3be7200fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 86.927738][ T5330] RAX: ffffffffffffffda RBX: 00007f3be6625fa0 RCX: 00007f3be639f559 [ 86.931040][ T5330] RDX: 0000000000000004 RSI: 00002000000004c0 RDI: 0000000000000004 [ 86.934481][ T5330] RBP: 00007f3be6436b20 R08: 0000000000000000 R09: 0000000000000000 [ 86.937854][ T5330] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 86.941092][ T5330] R13: 00007f3be6626038 R14: 00007f3be6625fa0 R15: 00007ffdc8566378 [ 86.944537][ T5330] [ 86.945914][ T5330] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 86.948943][ T5330] CPU: 0 UID: 0 PID: 5330 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 86.952807][ T5330] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 86.957062][ T5330] Call Trace: [ 86.958572][ T5330] [ 86.959831][ T5330] vpanic+0x56d/0xa60 [ 86.961650][ T5330] ? __pfx__printk+0x10/0x10 [ 86.963940][ T5330] ? __pfx_vpanic+0x10/0x10 [ 86.966493][ T5330] ? is_bpf_text_address+0x292/0x2b0 [ 86.969435][ T5330] ? is_bpf_text_address+0x26/0x2b0 [ 86.971864][ T5330] panic+0xc5/0xd0 [ 86.973566][ T5330] ? __pfx_panic+0x10/0x10 [ 86.975429][ T5330] __warn+0x315/0x4c0 [ 86.977091][ T5330] ? __dev_queue_xmit+0x1fd7/0x3920 [ 86.979366][ T5330] ? __dev_queue_xmit+0x1fd7/0x3920 [ 86.981615][ T5330] __report_bug+0x276/0x570 [ 86.983661][ T5330] ? __dev_queue_xmit+0x1fd7/0x3920 [ 86.985972][ T5330] ? __pfx___report_bug+0x10/0x10 [ 86.988232][ T5330] ? __lock_acquire+0x747/0x2de0 [ 86.990468][ T5330] report_bug_entry+0x19b/0x290 [ 86.992696][ T5330] ? __dev_queue_xmit+0x1fde/0x3920 [ 86.994956][ T5330] ? __dev_queue_xmit+0x1fe3/0x3920 [ 86.997284][ T5330] handle_bug+0xce/0x200 [ 86.999153][ T5330] exc_invalid_op+0x1a/0x50 [ 87.001177][ T5330] asm_exc_invalid_op+0x1a/0x20 [ 87.003387][ T5330] RIP: 0010:__dev_queue_xmit+0x1fde/0x3920 [ 87.005897][ T5330] Code: 48 c7 44 24 08 00 00 00 00 e9 58 fe ff ff e8 f9 a4 11 f8 90 0f 0b 90 e9 ba e1 ff ff 48 8d 3d 19 56 d3 07 48 c7 c6 64 58 68 8e <67> 48 0f b9 3a 80 3d 9f 9a ad 07 01 0f 85 78 03 00 00 e8 cb a4 11 [ 87.016040][ T5330] RSP: 0018:ffffc9000ea06b40 EFLAGS: 00010246 [ 87.018941][ T5330] RAX: ffffffff89b67364 RBX: ffff88801fa97210 RCX: ffff88800030cb00 [ 87.022409][ T5330] RDX: 0000000000000002 RSI: ffffffff8e685864 RDI: ffffffff9189e770 [ 87.026359][ T5330] RBP: ffffc9000ea06df0 R08: ffff888053fa1ee3 R09: 1ffff1100a7f43dc [ 87.030358][ T5330] R10: dffffc0000000000 R11: ffffffff89dee2c0 R12: dffffc0000000000 [ 87.034126][ T5330] R13: 1ffff92001d40d88 R14: 0000000000000000 R15: ffff88801fa97210 [ 87.037621][ T5330] ? __pfx_dev_queue_xmit+0x10/0x10 [ 87.039905][ T5330] ? __dev_queue_xmit+0x1e4/0x3920 [ 87.042207][ T5330] ? lock_acquire+0x115/0x350 [ 87.044307][ T5330] ? is_bpf_text_address+0x292/0x2b0 [ 87.046558][ T5330] ? is_bpf_text_address+0x26/0x2b0 [ 87.048711][ T5330] ? kmem_cache_alloc_noprof+0x156/0x600 [ 87.051084][ T5330] ? __pfx___dev_queue_xmit+0x10/0x10 [ 87.053324][ T5330] ? do_raw_spin_lock+0x12b/0x2f0 [ 87.055513][ T5330] ? lock_acquire+0x115/0x350 [ 87.057588][ T5330] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 87.060203][ T5330] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 87.062815][ T5330] ? stack_depot_save_flags+0x3e0/0x7f0 [ 87.065267][ T5330] ? skb_clone+0x212/0x3a0 [ 87.067193][ T5330] ? kmem_cache_alloc_noprof+0x156/0x600 [ 87.069841][ T5330] ? __pfx_dev_queue_xmit+0x10/0x10 [ 87.072142][ T5330] sch_frag_xmit_hook+0x28b/0x1550 [ 87.074318][ T5330] ? tcf_mirred_to_dev+0x274/0xe60 [ 87.076524][ T5330] ? tcf_mirred_act+0x1169/0x1880 [ 87.078677][ T5330] ? tcf_classify+0x43d/0x1160 [ 87.081056][ T5330] ? tc_run+0x42d/0x750 [ 87.082996][ T5330] ? __netif_receive_skb_core+0x1443/0x30c0 [ 87.085599][ T5330] ? netif_receive_skb+0x1fe/0xbf0 [ 87.087860][ T5330] ? tun_rx_batched+0x1de/0x790 [ 87.089860][ T5330] ? __pfx_sch_frag_xmit_hook+0x10/0x10 [ 87.092071][ T5330] ? ksys_write+0x150/0x270 [ 87.093886][ T5330] ? do_syscall_64+0x166/0x520 [ 87.095864][ T5330] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.098358][ T5330] ? __copy_skb_header+0xa3/0x4a0 [ 87.100443][ T5330] ? __asan_memcpy+0x40/0x70 [ 87.102511][ T5330] ? __skb_clone+0x5c/0x6c0 [ 87.104495][ T5330] ? __skb_clone+0x449/0x6c0 [ 87.106394][ T5330] ? skb_clone+0x246/0x3a0 [ 87.108156][ T5330] ? tcf_mirred_to_dev+0x2c5/0xe60 [ 87.110360][ T5330] tcf_mirred_to_dev+0x854/0xe60 [ 87.112459][ T5330] tcf_mirred_act+0x1169/0x1880 [ 87.114486][ T5330] ? __pfx_tcf_mirred_act+0x10/0x10 [ 87.116636][ T5330] ? skb_copy_bits+0x83/0x8e0 [ 87.118670][ T5330] tcf_action_exec+0x185/0x8d0 [ 87.120704][ T5330] tcf_classify+0x43d/0x1160 [ 87.122809][ T5330] tc_run+0x42d/0x750 [ 87.124652][ T5330] ? __pfx_tc_run+0x10/0x10 [ 87.126717][ T5330] __netif_receive_skb_core+0x1443/0x30c0 [ 87.129310][ T5330] ? __pfx___netif_receive_skb_core+0x10/0x10 [ 87.132117][ T5330] ? __alloc_skb+0x27a/0x7a0 [ 87.134162][ T5330] ? rcu_is_watching+0x16/0xb0 [ 87.136293][ T5330] ? __alloc_skb+0x27a/0x7a0 [ 87.138372][ T5330] ? trace_kmem_cache_alloc+0x29/0xe0 [ 87.140689][ T5330] ? netif_receive_skb+0x102/0xbf0 [ 87.142769][ T5330] ? netif_receive_skb+0x102/0xbf0 [ 87.144850][ T5330] netif_receive_skb+0x1fe/0xbf0 [ 87.147115][ T5330] ? __pfx_netif_receive_skb+0x10/0x10 [ 87.149595][ T5330] ? tun_rx_batched+0x185/0x790 [ 87.151781][ T5330] tun_rx_batched+0x1de/0x790 [ 87.153887][ T5330] ? __pfx_tun_rx_batched+0x10/0x10 [ 87.156155][ T5330] ? lock_acquire+0x115/0x350 [ 87.158181][ T5330] ? tun_get_user+0x1d3f/0x4450 [ 87.160255][ T5330] ? __local_bh_enable_ip+0xd6/0x140 [ 87.162189][ T5330] tun_get_user+0x2bb1/0x4450 [ 87.164230][ T5330] ? tun_get_user+0x27a6/0x4450 [ 87.166259][ T5330] ? aa_file_perm+0x18b/0x15f0 [ 87.168244][ T5330] ? aa_file_perm+0x4ed/0x15f0 [ 87.170229][ T5330] ? __pfx_tun_get_user+0x10/0x10 [ 87.172322][ T5330] ? __lock_acquire+0x747/0x2de0 [ 87.174378][ T5330] ? ref_tracker_alloc+0x341/0x4b0 [ 87.176627][ T5330] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 87.179051][ T5330] ? lock_acquire+0x115/0x350 [ 87.181190][ T5330] ? tun_get+0x1c/0x2f0 [ 87.183024][ T5330] ? tun_get+0x1c/0x2f0 [ 87.184956][ T5330] ? tun_get+0x1c/0x2f0 [ 87.186861][ T5330] tun_chr_write_iter+0x113/0x200 [ 87.189082][ T5330] vfs_write+0x612/0xba0 [ 87.191012][ T5330] ? __pfx_vfs_write+0x10/0x10 [ 87.193196][ T5330] ? __fget_files+0x3a2/0x420 [ 87.195323][ T5330] ? __fget_files+0x2a/0x420 [ 87.197320][ T5330] ? fdget+0x1ac/0x250 [ 87.199176][ T5330] ksys_write+0x150/0x270 [ 87.201082][ T5330] ? __pfx_ksys_write+0x10/0x10 [ 87.203245][ T5330] do_syscall_64+0x166/0x520 [ 87.205306][ T5330] ? trace_irq_disable+0x3b/0x140 [ 87.207612][ T5330] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.210378][ T5330] ? clear_bhb_loop+0x70/0xc0 [ 87.212513][ T5330] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.215146][ T5330] RIP: 0033:0x7f3be639f559 [ 87.217070][ T5330] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 87.224969][ T5330] RSP: 002b:00007f3be7200fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 87.228320][ T5330] RAX: ffffffffffffffda RBX: 00007f3be6625fa0 RCX: 00007f3be639f559 [ 87.231542][ T5330] RDX: 0000000000000004 RSI: 00002000000004c0 RDI: 0000000000000004 [ 87.234781][ T5330] RBP: 00007f3be6436b20 R08: 0000000000000000 R09: 0000000000000000 [ 87.238059][ T5330] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 87.241617][ T5330] R13: 00007f3be6626038 R14: 00007f3be6625fa0 R15: 00007ffdc8566378 [ 87.245224][ T5330] [ 87.249970][ T5330] Kernel Offset: disabled [ 87.251953][ T5330] Rebooting in 86400 seconds..